SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 28 Next »

The javax.net.ssl.SSLSocket class must be used instead of the java.net.Socket socket class when transferring sensitive data over insecure communication channels. The class SSLSockets provides security protocols such as SSL/TLS to ensure that the channel is not vulnerable to eavesdropping and malicious tampering.

The principal protections included in SSLSockets that are not provided by the Socket class are: [[Java API]]

  • Integrity Protection. SSL protects against modification of messages by an active wiretapper.
  • Authentication. In most modes, SSL provides peer authentication. Servers are usually authenticated, and clients may be authenticated as requested by servers.
  • Confidentiality (Privacy Protection). In most modes, SSL encrypts data being sent between client and server. This protects the confidentiality of data, so that passive wiretappers won't see sensitive data such as financial information or personal information of many kinds.

It is also important to use SSL for secure Remote Method Invocation (RMI) communications because RMI depends on object serialization and serialized data must be safeguarded in transit. Gong et al. [[Gong 03]] describe how to secure RMI communications using SSLSockets.

Noncompliant Code Example

This example shows the use of regular sockets for a server application that does not protect sensitive information in transit. The insecure code for the corresponding client application follows the server's code. 

  
// Exception handling has been omitted for the sake of brevity
class EchoServer { 
  public static void main(String[] args) throws IOException { 
    ServerSocket serverSocket = new ServerSocket(10007); 
    Socket socket = serverSocket.accept();
			
    PrintWriter out = new PrintWriter(socket.getOutputStream(), true); 
    BufferedReader in = new BufferedReader(
      new InputStreamReader(socket.getInputStream())); 

    String inputLine; 
    while ((inputLine = in.readLine()) != null) { 
      System.out.println(inputLine); 
      out.println(inputLine); 
    }
      
    // close out, in, socket (preferably in a try-finally block)   
  }
}

class EchoClient {
  public static void main(String[] args) throws IOException { 
    Socket socket = new Socket("localhost", 9999);
						
    PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
    BufferedReader in = new BufferedReader(
      new InputStreamReader(socket.getInputStream()));

    BufferedReader stdIn = new BufferedReader(
      new InputStreamReader(System.in));
			
    String userInput;
    while ((userInput = stdIn.readLine()) != null) {
      out.println(userInput);
      System.out.println(in.readLine());
    } 

    // close out, in, stdIn, socket (preferably in a try-finally block)   
  }
}

Compliant solution

This compliant solution makes use of SSLSockets to protect packets using the SSL/TLS security protocols.

// Exception handling has been omitted for the sake of brevity
class EchoServer {
  public static void main(String[] args) throws IOException {   
    SSLServerSocketFactory sslserversocketfactory =
      (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
    SSLServerSocket sslserversocket =
      (SSLServerSocket) sslserversocketfactory.createServerSocket(9999);
    SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();

    PrintWriter out = new PrintWriter( sslsocket.getOutputStream(),true);
    BufferedReader in = new BufferedReader(
      new InputStreamReader( sslsocket.getInputStream()));
            
    String inputLine;             
    while ((inputLine = in.readLine()) != null) { 
      System.out.println(inputLine); 
      out.println(inputLine); 
    } 

    // close out, in, sslsocket (preferably in a try-finally block)
  }
}

class EchoClient {
  public static void main(String[] args) throws IOException {
    SSLSocketFactory sslsocketfactory =
      (SSLSocketFactory) SSLSocketFactory.getDefault();
    SSLSocket sslsocket =
      (SSLSocket) sslsocketfactory.createSocket("localhost", 9999);

    PrintWriter out = new PrintWriter(sslsocket.getOutputStream(), true);
    BufferedReader in = new BufferedReader(
      new InputStreamReader(sslsocket.getInputStream()));
			
    BufferedReader stdIn = new BufferedReader(
      new InputStreamReader(System.in));
            
    String userInput;
    while ((userInput = stdIn.readLine()) != null) {
      out.println(userInput);
      System.out.println(in.readLine());
    }
  
    // close out, in, stdIn, sslsocket (preferably in a try-finally block)
  }
}

Note that a program that makes use of SSLSockets will block indefinitely if it tries to connect to a port that is not using SSL. Similarly, a program that does not use SSLSockets will block when trying to establish a connection through a port that uses SSL.

Risk assesment

Using plain sockets instead of SSLSockets means that the data's confidentiality and integrity is not guaranteed.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

SEC09- J

medium

likely

high

P6

L2

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Exceptions

EX1: Because of the mechanisms that SSLSockets provide to ensure the secure transfer of packets, significant performance overhead may result. If no sensitive information is being transmitted, or the channel is not prone to attacks, regular Sockets are sufficient.

References

[[API 06]]
[[Gong 03]] 11.3.3 "Securing RMI Communications"
[[Ware 08]]
[[MITRE 09]] CWE ID 311 "Failure to Encrypt Sensitive Data"

SEC08-J. Define custom security permissions for fine grained security      02. Platform Security (SEC)      SEC10-J. Call the superclass's getPermissions method when writing a custom class loader

  • No labels